Compliance Knowledge Tree

Start here for the ISMS model, Statement of Applicability, policy structure, roles, and core implementation concepts.

The management-system clauses that define context, leadership, planning, support, operations, evaluation, and improvement.

A.5 controls for governance, policies, suppliers, incidents, business continuity, legal requirements, and information handling.

A.6 controls for screening, employment terms, awareness, disciplinary process, termination, confidentiality, remote work, and reporting.

A.7 controls for physical perimeters, entry, secure areas, monitoring, environmental threats, equipment placement, and clear desk/screen.

Practitioner guidance for turning ISO requirements into implementation plans, operating artifacts, and control ownership.

Evidence packs, audit questions, implementation proof, registers, and records that help prove controls are operating.

Risk treatment, ISO 27005 links, GRC mappings, control relationships, and cross-framework translation notes.

Study notes and control distinction cues for ISO 27001, ISO 27002, and ISO 27005 learning paths.

ISO 27002 orientation, control attributes, and evidence-oriented interpretation notes.

Control-by-control implementation meaning across organizational, people, and physical control families.

Templates, evidence packs, and proof patterns that support ISO 27002-aligned control implementation.

Mappings that connect ISO 27002 control guidance to ISO 27001, risk treatment, and audit evidence.

The ISO 27005 risk-management flow: context, assessment, treatment, communication, monitoring, and review.

Risk knowledge-base entries, GRC data-model notes, and scenario-driven control/evidence relationships.

Crosswalks that connect ISO 27005 risk treatment to ISO 27001 controls, implementation work, and audit evidence.

Material scope, territorial reach, personal-data concepts, and the controller, processor, representative, and DPO roles.

Purpose limitation, data minimization, lawful bases, consent, special-category data, retention, and processing changes.

Privacy notices, access, rectification, erasure, restriction, portability, objection, and request handling.

Records of processing, privacy by design, DPIAs, ownership, evidence, training, review, and ISO 27001 alignment.

Risk-based security, personal-data breach assessment, notification decisions, evidence, and response readiness.

Processor due diligence and contracts, subprocessors, international transfers, safeguards, and exit evidence.